3 ms·
Problem is, beyond a certain volume, even the upstream gear is gonna get saturated just reading the header on the bogus packets and directing them into the bit
by Karunamon 11y ago
Problem is, beyond a certain volume, even the upstream gear is gonna get saturated just reading the header on the bogus packets and directing them into the bit bucket. It's not unheard of for the larger attacks to take down entire ISPs.
- zo1 11y agoUnless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can kick them off the network after sufficient transgression, and ban their account at the hardware ADSL level (assuming that's what it is). This also presumes the ISP is willing to implement such a feature, and kick-off their paying (albeit infected) users. I don't know much about this stuff, so I'm extrapolating and pseudo-solving.
- toast0 11y agoUsually there's a lot of diversity in the immediate source of the traffic. If it's a volumetric attack, the immediate source is the misconfigured servers that spoofed packets are being sent to. If it's an in band attack, the immediate source is usually botnet members, but occasionally regular browsers being served bad scripts by a compromised or mitmed site. You could work to notify the network owners, but it's whack-a-mole; even with strong efforts there are enough DNS and ntp servers out there configured to generate a pretty big reflection.